December 2017 - openSUSE Security Announce

[security-announce] openSUSE-SU-2017:3245-1: important: Security update for chromium
by opensuse-security＠opensuse.org 08 Dec '17

08 Dec '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3245-1 Rating: important References: #1064066 #1064298 #1065405 #1066851 #1071691 Cross-References: CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-15396 CVE-2017-15398 CVE-2017-15399 CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129 CVE-2017-5130 CVE-2017-5131 CVE-2017-5132 CVE-2017-5133 Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 41 vulnerabilities is now available. Description: This update to Chromium 63.0.3239.84 fixes the following security issues: - CVE-2017-5124: UXSS with MHTML - CVE-2017-5125: Heap overflow in Skia - CVE-2017-5126: Use after free in PDFium - CVE-2017-5127: Use after free in PDFium - CVE-2017-5128: Heap overflow in WebGL - CVE-2017-5129: Use after free in WebAudio - CVE-2017-5132: Incorrect stack manipulation in WebAssembly. - CVE-2017-5130: Heap overflow in libxml2 - CVE-2017-5131: Out of bounds write in Skia - CVE-2017-5133: Out of bounds write in Skia - CVE-2017-15386: UI spoofing in Blink - CVE-2017-15387: Content security bypass - CVE-2017-15388: Out of bounds read in Skia - CVE-2017-15389: URL spoofing in OmniBox - CVE-2017-15390: URL spoofing in OmniBox - CVE-2017-15391: Extension limitation bypass in Extensions. - CVE-2017-15392: Incorrect registry key handling in PlatformIntegration - CVE-2017-15393: Referrer leak in Devtools - CVE-2017-15394: URL spoofing in extensions UI - CVE-2017-15395: Null pointer dereference in ImageCapture - CVE-2017-15396: Stack overflow in V8 - CVE-2017-15398: Stack buffer overflow in QUIC - CVE-2017-15399: Use after free in V8 - CVE-2017-15408: Heap buffer overflow in PDFium - CVE-2017-15409: Out of bounds write in Skia - CVE-2017-15410: Use after free in PDFium - CVE-2017-15411: Use after free in PDFium - CVE-2017-15412: Use after free in libXML - CVE-2017-15413: Type confusion in WebAssembly - CVE-2017-15415: Pointer information disclosure in IPC call - CVE-2017-15416: Out of bounds read in Blink - CVE-2017-15417: Cross origin information disclosure in Skia - CVE-2017-15418: Use of uninitialized value in Skia - CVE-2017-15419: Cross origin leak of redirect URL in Blink - CVE-2017-15420: URL spoofing in Omnibox - CVE-2017-15422: Integer overflow in ICU - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL - CVE-2017-15424: URL Spoof in Omnibox - CVE-2017-15425: URL Spoof in Omnibox - CVE-2017-15426: URL Spoof in Omnibox - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox The following tracked bug fixes are included: - sandbox crash fixes (bsc#1064298) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2017-1352=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (x86_64): chromedriver-63.0.3239.84-40.1 chromium-63.0.3239.84-40.1 References: https://www.suse.com/security/cve/CVE-2017-15386.html https://www.suse.com/security/cve/CVE-2017-15387.html https://www.suse.com/security/cve/CVE-2017-15388.html https://www.suse.com/security/cve/CVE-2017-15389.html https://www.suse.com/security/cve/CVE-2017-15390.html https://www.suse.com/security/cve/CVE-2017-15391.html https://www.suse.com/security/cve/CVE-2017-15392.html https://www.suse.com/security/cve/CVE-2017-15393.html https://www.suse.com/security/cve/CVE-2017-15394.html https://www.suse.com/security/cve/CVE-2017-15395.html https://www.suse.com/security/cve/CVE-2017-15396.html https://www.suse.com/security/cve/CVE-2017-15398.html https://www.suse.com/security/cve/CVE-2017-15399.html https://www.suse.com/security/cve/CVE-2017-15408.html https://www.suse.com/security/cve/CVE-2017-15409.html https://www.suse.com/security/cve/CVE-2017-15410.html https://www.suse.com/security/cve/CVE-2017-15411.html https://www.suse.com/security/cve/CVE-2017-15412.html https://www.suse.com/security/cve/CVE-2017-15413.html https://www.suse.com/security/cve/CVE-2017-15415.html https://www.suse.com/security/cve/CVE-2017-15416.html https://www.suse.com/security/cve/CVE-2017-15417.html https://www.suse.com/security/cve/CVE-2017-15418.html https://www.suse.com/security/cve/CVE-2017-15419.html https://www.suse.com/security/cve/CVE-2017-15420.html https://www.suse.com/security/cve/CVE-2017-15422.html https://www.suse.com/security/cve/CVE-2017-15423.html https://www.suse.com/security/cve/CVE-2017-15424.html https://www.suse.com/security/cve/CVE-2017-15425.html https://www.suse.com/security/cve/CVE-2017-15426.html https://www.suse.com/security/cve/CVE-2017-15427.html https://www.suse.com/security/cve/CVE-2017-5124.html https://www.suse.com/security/cve/CVE-2017-5125.html https://www.suse.com/security/cve/CVE-2017-5126.html https://www.suse.com/security/cve/CVE-2017-5127.html https://www.suse.com/security/cve/CVE-2017-5128.html https://www.suse.com/security/cve/CVE-2017-5129.html https://www.suse.com/security/cve/CVE-2017-5130.html https://www.suse.com/security/cve/CVE-2017-5131.html https://www.suse.com/security/cve/CVE-2017-5132.html https://www.suse.com/security/cve/CVE-2017-5133.html https://bugzilla.suse.com/1064066 https://bugzilla.suse.com/1064298 https://bugzilla.suse.com/1065405 https://bugzilla.suse.com/1066851 https://bugzilla.suse.com/1071691 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:3244-1: important: Security update for chromium
by opensuse-security＠opensuse.org 08 Dec '17

08 Dec '17

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3244-1 Rating: important References: #1071691 Cross-References: CVE-2017-15408 CVE-2017-15409 CVE-2017-15410 CVE-2017-15411 CVE-2017-15412 CVE-2017-15413 CVE-2017-15415 CVE-2017-15416 CVE-2017-15417 CVE-2017-15418 CVE-2017-15419 CVE-2017-15420 CVE-2017-15422 CVE-2017-15423 CVE-2017-15424 CVE-2017-15425 CVE-2017-15426 CVE-2017-15427 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: This update to Chromium 63.0.3239.84 fixes the following security issues: - CVE-2017-15408: Heap buffer overflow in PDFium - CVE-2017-15409: Out of bounds write in Skia - CVE-2017-15410: Use after free in PDFium - CVE-2017-15411: Use after free in PDFium - CVE-2017-15412: Use after free in libXML - CVE-2017-15413: Type confusion in WebAssembly - CVE-2017-15415: Pointer information disclosure in IPC call - CVE-2017-15416: Out of bounds read in Blink - CVE-2017-15417: Cross origin information disclosure in Skia - CVE-2017-15418: Use of uninitialized value in Skia - CVE-2017-15419: Cross origin leak of redirect URL in Blink - CVE-2017-15420: URL spoofing in Omnibox - CVE-2017-15422: Integer overflow in ICU - CVE-2017-15423: Issue with SPAKE implementation in BoringSSL - CVE-2017-15424: URL Spoof in Omnibox - CVE-2017-15425: URL Spoof in Omnibox - CVE-2017-15426: URL Spoof in Omnibox - CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1349=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1349=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): chromedriver-63.0.3239.84-127.1 chromedriver-debuginfo-63.0.3239.84-127.1 chromium-63.0.3239.84-127.1 chromium-debuginfo-63.0.3239.84-127.1 chromium-debugsource-63.0.3239.84-127.1 - openSUSE Leap 42.2 (x86_64): chromedriver-63.0.3239.84-104.41.1 chromedriver-debuginfo-63.0.3239.84-104.41.1 chromium-63.0.3239.84-104.41.1 chromium-debuginfo-63.0.3239.84-104.41.1 chromium-debugsource-63.0.3239.84-104.41.1 References: https://www.suse.com/security/cve/CVE-2017-15408.html https://www.suse.com/security/cve/CVE-2017-15409.html https://www.suse.com/security/cve/CVE-2017-15410.html https://www.suse.com/security/cve/CVE-2017-15411.html https://www.suse.com/security/cve/CVE-2017-15412.html https://www.suse.com/security/cve/CVE-2017-15413.html https://www.suse.com/security/cve/CVE-2017-15415.html https://www.suse.com/security/cve/CVE-2017-15416.html https://www.suse.com/security/cve/CVE-2017-15417.html https://www.suse.com/security/cve/CVE-2017-15418.html https://www.suse.com/security/cve/CVE-2017-15419.html https://www.suse.com/security/cve/CVE-2017-15420.html https://www.suse.com/security/cve/CVE-2017-15422.html https://www.suse.com/security/cve/CVE-2017-15423.html https://www.suse.com/security/cve/CVE-2017-15424.html https://www.suse.com/security/cve/CVE-2017-15425.html https://www.suse.com/security/cve/CVE-2017-15426.html https://www.suse.com/security/cve/CVE-2017-15427.html https://bugzilla.suse.com/1071691 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3242-1: important: Security update for xen
by opensuse-security＠opensuse.org 08 Dec '17

08 Dec '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3242-1 Rating: important References: #1055047 #1056336 #1061075 #1061081 #1061086 #1063123 #1068187 #1068191 Cross-References: CVE-2017-13672 CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056336) This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-xen-13372=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-xen-13372=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-xen-13372=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): xen-devel-4.4.4_26-61.17.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): xen-kmp-default-4.4.4_26_3.0.101_108.13-61.17.1 xen-libs-4.4.4_26-61.17.1 xen-tools-domU-4.4.4_26-61.17.1 - SUSE Linux Enterprise Server 11-SP4 (x86_64): xen-4.4.4_26-61.17.1 xen-doc-html-4.4.4_26-61.17.1 xen-libs-32bit-4.4.4_26-61.17.1 xen-tools-4.4.4_26-61.17.1 - SUSE Linux Enterprise Server 11-SP4 (i586): xen-kmp-pae-4.4.4_26_3.0.101_108.13-61.17.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): xen-debuginfo-4.4.4_26-61.17.1 xen-debugsource-4.4.4_26-61.17.1 References: https://www.suse.com/security/cve/CVE-2017-13672.html https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1056336 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:3241-1: important: Security update for opensaml
by opensuse-security＠opensuse.org 08 Dec '17

08 Dec '17

openSUSE Security Update: Security update for opensaml ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3241-1 Rating: important References: #1068685 Cross-References: CVE-2017-16853 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opensaml fixes the following issues: Security issue fixed: - CVE-2017-16853: Fix the DynamicMetadataProvider class to properly configure itself with the MetadataFilter plugins, to avoid possible MITM attacks (bsc#1068685). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1350=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1350=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): libsaml-devel-2.5.5-6.1 libsaml8-2.5.5-6.1 libsaml8-debuginfo-2.5.5-6.1 opensaml-bin-2.5.5-6.1 opensaml-bin-debuginfo-2.5.5-6.1 opensaml-debugsource-2.5.5-6.1 opensaml-schemas-2.5.5-6.1 - openSUSE Leap 42.2 (x86_64): libsaml-devel-2.5.5-3.3.1 libsaml8-2.5.5-3.3.1 libsaml8-debuginfo-2.5.5-3.3.1 opensaml-bin-2.5.5-3.3.1 opensaml-bin-debuginfo-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 opensaml-schemas-2.5.5-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-16853.html https://bugzilla.suse.com/1068685 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3239-1: important: Security update for xen
by opensuse-security＠opensuse.org 08 Dec '17

08 Dec '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3239-1 Rating: important References: #1055047 #1056336 #1061075 #1061081 #1061086 #1063123 #1068187 #1068191 Cross-References: CVE-2017-13672 CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056336) This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-2019=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-LTSS (x86_64): xen-4.4.4_26-22.59.3 xen-debugsource-4.4.4_26-22.59.3 xen-doc-html-4.4.4_26-22.59.3 xen-kmp-default-4.4.4_26_k3.12.61_52.101-22.59.3 xen-kmp-default-debuginfo-4.4.4_26_k3.12.61_52.101-22.59.3 xen-libs-32bit-4.4.4_26-22.59.3 xen-libs-4.4.4_26-22.59.3 xen-libs-debuginfo-32bit-4.4.4_26-22.59.3 xen-libs-debuginfo-4.4.4_26-22.59.3 xen-tools-4.4.4_26-22.59.3 xen-tools-debuginfo-4.4.4_26-22.59.3 xen-tools-domU-4.4.4_26-22.59.3 xen-tools-domU-debuginfo-4.4.4_26-22.59.3 References: https://www.suse.com/security/cve/CVE-2017-13672.html https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1056336 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3236-1: important: Security update for xen
by opensuse-security＠opensuse.org 07 Dec '17

07 Dec '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3236-1 Rating: important References: #1055047 #1056336 #1061075 #1061081 #1061086 #1063123 #1068187 #1068191 Cross-References: CVE-2017-13672 CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that solves 5 vulnerabilities and has three fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056336) This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-2013=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-2013=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-2013=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): xen-4.5.5_20-22.36.3 xen-debugsource-4.5.5_20-22.36.3 xen-doc-html-4.5.5_20-22.36.3 xen-kmp-default-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-kmp-default-debuginfo-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-libs-32bit-4.5.5_20-22.36.3 xen-libs-4.5.5_20-22.36.3 xen-libs-debuginfo-32bit-4.5.5_20-22.36.3 xen-libs-debuginfo-4.5.5_20-22.36.3 xen-tools-4.5.5_20-22.36.3 xen-tools-debuginfo-4.5.5_20-22.36.3 xen-tools-domU-4.5.5_20-22.36.3 xen-tools-domU-debuginfo-4.5.5_20-22.36.3 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): xen-4.5.5_20-22.36.3 xen-debugsource-4.5.5_20-22.36.3 xen-doc-html-4.5.5_20-22.36.3 xen-kmp-default-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-kmp-default-debuginfo-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-libs-32bit-4.5.5_20-22.36.3 xen-libs-4.5.5_20-22.36.3 xen-libs-debuginfo-32bit-4.5.5_20-22.36.3 xen-libs-debuginfo-4.5.5_20-22.36.3 xen-tools-4.5.5_20-22.36.3 xen-tools-debuginfo-4.5.5_20-22.36.3 xen-tools-domU-4.5.5_20-22.36.3 xen-tools-domU-debuginfo-4.5.5_20-22.36.3 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): xen-4.5.5_20-22.36.3 xen-debugsource-4.5.5_20-22.36.3 xen-doc-html-4.5.5_20-22.36.3 xen-kmp-default-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-kmp-default-debuginfo-4.5.5_20_k3.12.74_60.64.63-22.36.3 xen-libs-32bit-4.5.5_20-22.36.3 xen-libs-4.5.5_20-22.36.3 xen-libs-debuginfo-32bit-4.5.5_20-22.36.3 xen-libs-debuginfo-4.5.5_20-22.36.3 xen-tools-4.5.5_20-22.36.3 xen-tools-debuginfo-4.5.5_20-22.36.3 xen-tools-domU-4.5.5_20-22.36.3 xen-tools-domU-debuginfo-4.5.5_20-22.36.3 References: https://www.suse.com/security/cve/CVE-2017-13672.html https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1056336 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3235-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 07 Dec '17

07 Dec '17

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3235-1 Rating: important References: #1070162 Cross-References: CVE-2016-9841 CVE-2017-10281 CVE-2017-10285 CVE-2017-10293 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 15 vulnerabilities is now available. Description: This update for java-1_6_0-ibm fixes the following issues: Security issues fixed: - Security update to version 6.0.16.50 (bsc#1070162) * CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347 CVE-2017-10350 CVE-2017-10281 CVE-2017-10295 CVE-2017-10345 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2017-2018=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.50-50.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.50-50.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.50-50.3.1 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.50-50.3.1 References: https://www.suse.com/security/cve/CVE-2016-9841.html https://www.suse.com/security/cve/CVE-2017-10281.html https://www.suse.com/security/cve/CVE-2017-10285.html https://www.suse.com/security/cve/CVE-2017-10293.html https://www.suse.com/security/cve/CVE-2017-10295.html https://www.suse.com/security/cve/CVE-2017-10345.html https://www.suse.com/security/cve/CVE-2017-10346.html https://www.suse.com/security/cve/CVE-2017-10347.html https://www.suse.com/security/cve/CVE-2017-10348.html https://www.suse.com/security/cve/CVE-2017-10349.html https://www.suse.com/security/cve/CVE-2017-10350.html https://www.suse.com/security/cve/CVE-2017-10355.html https://www.suse.com/security/cve/CVE-2017-10356.html https://www.suse.com/security/cve/CVE-2017-10357.html https://www.suse.com/security/cve/CVE-2017-10388.html https://bugzilla.suse.com/1070162 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3234-1: important: Security update for opensaml
by opensuse-security＠opensuse.org 07 Dec '17

07 Dec '17

SUSE Security Update: Security update for opensaml ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3234-1 Rating: important References: #1068685 Cross-References: CVE-2017-16853 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opensaml fixes the following issues: Security issue fixed: - CVE-2017-16853: Fix the DynamicMetadataProvider class to properly configure itself with the MetadataFilter plugins, to avoid possible MITM attacks (bsc#1068685). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2011=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2011=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2011=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2011=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2011=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): libsaml-devel-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): libsaml-devel-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libsaml8-2.5.5-3.3.1 libsaml8-debuginfo-2.5.5-3.3.1 opensaml-bin-2.5.5-3.3.1 opensaml-bin-debuginfo-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 opensaml-schemas-2.5.5-3.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libsaml8-2.5.5-3.3.1 libsaml8-debuginfo-2.5.5-3.3.1 opensaml-bin-2.5.5-3.3.1 opensaml-bin-debuginfo-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 opensaml-schemas-2.5.5-3.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libsaml8-2.5.5-3.3.1 libsaml8-debuginfo-2.5.5-3.3.1 opensaml-bin-2.5.5-3.3.1 opensaml-bin-debuginfo-2.5.5-3.3.1 opensaml-debugsource-2.5.5-3.3.1 opensaml-schemas-2.5.5-3.3.1 References: https://www.suse.com/security/cve/CVE-2017-16853.html https://bugzilla.suse.com/1068685 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3233-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 07 Dec '17

07 Dec '17

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3233-1 Rating: important References: #1068101 Cross-References: CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox ESR 52.5 fixes the following issues: Security issues fixed: - CVE-2017-7826: Memory safety bugs fixed (bsc#1068101). - CVE-2017-7828: Use-after-free of PressShell while restyling layout (bsc#1068101). - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API (bsc#1068101). Mozilla Foundation Security Advisory (MFSA 2017-25): - https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/ Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-13369=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-13369=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-MozillaFirefox-13369=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-MozillaFirefox-13369=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-13369=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-MozillaFirefox-13369=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-52.5.0esr-72.17.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-52.5.0esr-72.17.1 MozillaFirefox-translations-52.5.0esr-72.17.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): MozillaFirefox-52.5.0esr-72.17.1 MozillaFirefox-translations-52.5.0esr-72.17.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): MozillaFirefox-52.5.0esr-72.17.1 MozillaFirefox-translations-52.5.0esr-72.17.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-52.5.0esr-72.17.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): MozillaFirefox-debuginfo-52.5.0esr-72.17.1 References: https://www.suse.com/security/cve/CVE-2017-7826.html https://www.suse.com/security/cve/CVE-2017-7828.html https://www.suse.com/security/cve/CVE-2017-7830.html https://bugzilla.suse.com/1068101 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:3229-1: important: Security update for shibboleth-sp
by opensuse-security＠opensuse.org 07 Dec '17

07 Dec '17

openSUSE Security Update: Security update for shibboleth-sp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3229-1 Rating: important References: #1068689 Cross-References: CVE-2017-16852 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shibboleth-sp fixes the following issues: Security issue fixed: - CVE-2017-16852: Fix critical security checks in the Dynamic MetadataProvider plugin in Shibboleth Service (bsc#1068689). This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1348=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1348=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): libshibsp-lite6-2.5.5-9.2 libshibsp-lite6-debuginfo-2.5.5-9.2 libshibsp6-2.5.5-9.2 libshibsp6-debuginfo-2.5.5-9.2 shibboleth-sp-2.5.5-9.2 shibboleth-sp-debuginfo-2.5.5-9.2 shibboleth-sp-debugsource-2.5.5-9.2 shibboleth-sp-devel-2.5.5-9.2 - openSUSE Leap 42.2 (x86_64): libshibsp-lite6-2.5.5-6.3.1 libshibsp-lite6-debuginfo-2.5.5-6.3.1 libshibsp6-2.5.5-6.3.1 libshibsp6-debuginfo-2.5.5-6.3.1 shibboleth-sp-2.5.5-6.3.1 shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 shibboleth-sp-devel-2.5.5-6.3.1 References: https://www.suse.com/security/cve/CVE-2017-16852.html https://bugzilla.suse.com/1068689 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3226-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 06 Dec '17

06 Dec '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3226-1 Rating: important References: #1069496 #1069702 #1070805 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise High Availability 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 OpenStack Cloud Magnum Orchestration 7 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000405: A bug in the THP CoW support could be used by local attackers to corrupt memory of other processes and cause them to crash (bnc#1069496). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702). The following non-security bugs were fixed: Fix a build issue on ppc64le systems (bsc#1070805) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP2: zypper in -t patch SUSE-SLE-WE-12-SP2-2017-2007=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2007=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2007=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2007=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2017-2007=1 - SUSE Linux Enterprise High Availability 12-SP2: zypper in -t patch SUSE-SLE-HA-12-SP2-2017-2007=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-2007=1 - OpenStack Cloud Magnum Orchestration 7: zypper in -t patch SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-2007=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP2 (x86_64): kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 kernel-default-extra-4.4.90-92.50.1 kernel-default-extra-debuginfo-4.4.90-92.50.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): kernel-obs-build-4.4.90-92.50.1 kernel-obs-build-debugsource-4.4.90-92.50.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (noarch): kernel-docs-4.4.90-92.50.3 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): kernel-default-4.4.90-92.50.1 kernel-default-base-4.4.90-92.50.1 kernel-default-base-debuginfo-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 kernel-default-devel-4.4.90-92.50.1 kernel-syms-4.4.90-92.50.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): kernel-devel-4.4.90-92.50.1 kernel-macros-4.4.90-92.50.1 kernel-source-4.4.90-92.50.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): kernel-default-4.4.90-92.50.1 kernel-default-base-4.4.90-92.50.1 kernel-default-base-debuginfo-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 kernel-default-devel-4.4.90-92.50.1 kernel-syms-4.4.90-92.50.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): kernel-devel-4.4.90-92.50.1 kernel-macros-4.4.90-92.50.1 kernel-source-4.4.90-92.50.1 - SUSE Linux Enterprise Server 12-SP2 (s390x): kernel-default-man-4.4.90-92.50.1 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_90-92_50-default-1-4.1 - SUSE Linux Enterprise High Availability 12-SP2 (ppc64le s390x x86_64): cluster-md-kmp-default-4.4.90-92.50.1 cluster-md-kmp-default-debuginfo-4.4.90-92.50.1 cluster-network-kmp-default-4.4.90-92.50.1 cluster-network-kmp-default-debuginfo-4.4.90-92.50.1 dlm-kmp-default-4.4.90-92.50.1 dlm-kmp-default-debuginfo-4.4.90-92.50.1 gfs2-kmp-default-4.4.90-92.50.1 gfs2-kmp-default-debuginfo-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 ocfs2-kmp-default-4.4.90-92.50.1 ocfs2-kmp-default-debuginfo-4.4.90-92.50.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): kernel-default-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 kernel-default-devel-4.4.90-92.50.1 kernel-default-extra-4.4.90-92.50.1 kernel-default-extra-debuginfo-4.4.90-92.50.1 kernel-syms-4.4.90-92.50.1 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): kernel-devel-4.4.90-92.50.1 kernel-macros-4.4.90-92.50.1 kernel-source-4.4.90-92.50.1 - OpenStack Cloud Magnum Orchestration 7 (x86_64): kernel-default-4.4.90-92.50.1 kernel-default-debuginfo-4.4.90-92.50.1 kernel-default-debugsource-4.4.90-92.50.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069496 https://bugzilla.suse.com/1069702 https://bugzilla.suse.com/1070805 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3225-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 06 Dec '17

06 Dec '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3225-1 Rating: important References: #1069496 #1069702 #1070805 Cross-References: CVE-2017-1000405 CVE-2017-16939 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Live Patching 12-SP3 SUSE Linux Enterprise High Availability 12-SP3 SUSE Linux Enterprise Desktop 12-SP3 SUSE Container as a Service Platform ALL ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000405: A bug in the THP CoW support could be used by local attackers to corrupt memory of other processes and cause them to crash (bnc#1069496). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702). The following non-security bugs were fixed: Fix a build issue on ppc64le systems (bsc#1070805) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP3: zypper in -t patch SUSE-SLE-WE-12-SP3-2017-2006=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2006=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2006=1 - SUSE Linux Enterprise Live Patching 12-SP3: zypper in -t patch SUSE-SLE-Live-Patching-12-SP3-2017-2006=1 - SUSE Linux Enterprise High Availability 12-SP3: zypper in -t patch SUSE-SLE-HA-12-SP3-2017-2006=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-2006=1 - SUSE Container as a Service Platform ALL: zypper in -t patch SUSE-CAASP-ALL-2017-2006=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64): kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 kernel-default-extra-4.4.92-6.30.1 kernel-default-extra-debuginfo-4.4.92-6.30.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): kernel-obs-build-4.4.92-6.30.1 kernel-obs-build-debugsource-4.4.92-6.30.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (noarch): kernel-docs-4.4.92-6.30.2 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): kernel-default-4.4.92-6.30.1 kernel-default-base-4.4.92-6.30.1 kernel-default-base-debuginfo-4.4.92-6.30.1 kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 kernel-default-devel-4.4.92-6.30.1 kernel-syms-4.4.92-6.30.1 - SUSE Linux Enterprise Server 12-SP3 (noarch): kernel-devel-4.4.92-6.30.1 kernel-macros-4.4.92-6.30.1 kernel-source-4.4.92-6.30.1 - SUSE Linux Enterprise Server 12-SP3 (s390x): kernel-default-man-4.4.92-6.30.1 - SUSE Linux Enterprise Live Patching 12-SP3 (ppc64le x86_64): kgraft-patch-4_4_92-6_30-default-1-6.1 kgraft-patch-4_4_92-6_30-default-debuginfo-1-6.1 - SUSE Linux Enterprise High Availability 12-SP3 (ppc64le s390x x86_64): cluster-md-kmp-default-4.4.92-6.30.1 cluster-md-kmp-default-debuginfo-4.4.92-6.30.1 dlm-kmp-default-4.4.92-6.30.1 dlm-kmp-default-debuginfo-4.4.92-6.30.1 gfs2-kmp-default-4.4.92-6.30.1 gfs2-kmp-default-debuginfo-4.4.92-6.30.1 kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 ocfs2-kmp-default-4.4.92-6.30.1 ocfs2-kmp-default-debuginfo-4.4.92-6.30.1 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): kernel-devel-4.4.92-6.30.1 kernel-macros-4.4.92-6.30.1 kernel-source-4.4.92-6.30.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): kernel-default-4.4.92-6.30.1 kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 kernel-default-devel-4.4.92-6.30.1 kernel-default-extra-4.4.92-6.30.1 kernel-default-extra-debuginfo-4.4.92-6.30.1 kernel-syms-4.4.92-6.30.1 - SUSE Container as a Service Platform ALL (x86_64): kernel-default-4.4.92-6.30.1 kernel-default-debuginfo-4.4.92-6.30.1 kernel-default-debugsource-4.4.92-6.30.1 References: https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1069496 https://bugzilla.suse.com/1069702 https://bugzilla.suse.com/1070805 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:3223-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 06 Dec '17

06 Dec '17

openSUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3223-1 Rating: important References: #1050632 #1056162 #1058485 #1058637 #1067181 #1067184 #1067409 Cross-References: CVE-2017-11640 CVE-2017-13737 CVE-2017-14341 CVE-2017-14342 CVE-2017-16545 CVE-2017-16546 CVE-2017-16669 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for GraphicsMagick fixes the following issues: Security issues fixed: - CVE-2017-16546: Fix ReadWPGImage function in coders/wpg.c that could lead to a denial of service (bsc#1067181). - CVE-2017-14342: Fix a memory exhaustion vulnerability in ReadWPGImage in coders/wpg.c that could lead to a denial of service (bsc#1058485). - CVE-2017-16669: Fix coders/wpg.c that allows remote attackers to cause a denial of service via crafted files (bsc#1067409). - CVE-2017-16545: Fix the ReadWPGImage function in coders/wpg.c as a validation problems could lead to a denial of service (bsc#1067184). - CVE-2017-14341: Fix infinite loop in the ReadWPGImage function (bsc#1058637). - CVE-2017-13737: Fix invalid free in the MagickFree function in magick/memory.c (tiff.c) (bsc#1056162). - CVE-2017-11640: Fix NULL pointer deref in WritePTIFImage() in coders/tiff.c (bsc#1050632). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1346=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1346=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): GraphicsMagick-1.3.25-44.1 GraphicsMagick-debuginfo-1.3.25-44.1 GraphicsMagick-debugsource-1.3.25-44.1 GraphicsMagick-devel-1.3.25-44.1 libGraphicsMagick++-Q16-12-1.3.25-44.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-44.1 libGraphicsMagick++-devel-1.3.25-44.1 libGraphicsMagick-Q16-3-1.3.25-44.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-44.1 libGraphicsMagick3-config-1.3.25-44.1 libGraphicsMagickWand-Q16-2-1.3.25-44.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-44.1 perl-GraphicsMagick-1.3.25-44.1 perl-GraphicsMagick-debuginfo-1.3.25-44.1 - openSUSE Leap 42.2 (i586 x86_64): GraphicsMagick-1.3.25-11.44.1 GraphicsMagick-debuginfo-1.3.25-11.44.1 GraphicsMagick-debugsource-1.3.25-11.44.1 GraphicsMagick-devel-1.3.25-11.44.1 libGraphicsMagick++-Q16-12-1.3.25-11.44.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.25-11.44.1 libGraphicsMagick++-devel-1.3.25-11.44.1 libGraphicsMagick-Q16-3-1.3.25-11.44.1 libGraphicsMagick-Q16-3-debuginfo-1.3.25-11.44.1 libGraphicsMagick3-config-1.3.25-11.44.1 libGraphicsMagickWand-Q16-2-1.3.25-11.44.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.25-11.44.1 perl-GraphicsMagick-1.3.25-11.44.1 perl-GraphicsMagick-debuginfo-1.3.25-11.44.1 References: https://www.suse.com/security/cve/CVE-2017-11640.html https://www.suse.com/security/cve/CVE-2017-13737.html https://www.suse.com/security/cve/CVE-2017-14341.html https://www.suse.com/security/cve/CVE-2017-14342.html https://www.suse.com/security/cve/CVE-2017-16545.html https://www.suse.com/security/cve/CVE-2017-16546.html https://www.suse.com/security/cve/CVE-2017-16669.html https://bugzilla.suse.com/1050632 https://bugzilla.suse.com/1056162 https://bugzilla.suse.com/1058485 https://bugzilla.suse.com/1058637 https://bugzilla.suse.com/1067181 https://bugzilla.suse.com/1067184 https://bugzilla.suse.com/1067409 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:3220-1: important: Security update for exim
by opensuse-security＠opensuse.org 06 Dec '17

06 Dec '17

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3220-1 Rating: important References: #1069857 Cross-References: CVE-2017-16943 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for exim fixes the following issues: Security issue fixed: - CVE-2017-16943: Fix possible remote code execution (boo#1069857). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1342=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1342=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): exim-4.86.2-17.1 exim-debuginfo-4.86.2-17.1 exim-debugsource-4.86.2-17.1 eximon-4.86.2-17.1 eximon-debuginfo-4.86.2-17.1 eximstats-html-4.86.2-17.1 - openSUSE Leap 42.2 (x86_64): exim-4.86.2-10.9.1 exim-debuginfo-4.86.2-10.9.1 exim-debugsource-4.86.2-10.9.1 eximon-4.86.2-10.9.1 eximon-debuginfo-4.86.2-10.9.1 eximstats-html-4.86.2-10.9.1 References: https://www.suse.com/security/cve/CVE-2017-16943.html https://bugzilla.suse.com/1069857 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3215-1: important: Security update for shibboleth-sp
by opensuse-security＠opensuse.org 05 Dec '17

05 Dec '17

SUSE Security Update: Security update for shibboleth-sp ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3215-1 Rating: important References: #1068689 Cross-References: CVE-2017-16852 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for shibboleth-sp fixes the following issues: Security issue fixed: - CVE-2017-16852: Fix critical security checks in the Dynamic MetadataProvider plugin in Shibboleth Service (bsc#1068689). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-2001=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-2001=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-2001=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-2001=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-2001=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 shibboleth-sp-devel-2.5.5-6.3.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 shibboleth-sp-devel-2.5.5-6.3.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): libshibsp-lite6-2.5.5-6.3.1 libshibsp-lite6-debuginfo-2.5.5-6.3.1 libshibsp6-2.5.5-6.3.1 libshibsp6-debuginfo-2.5.5-6.3.1 shibboleth-sp-2.5.5-6.3.1 shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): libshibsp-lite6-2.5.5-6.3.1 libshibsp-lite6-debuginfo-2.5.5-6.3.1 libshibsp6-2.5.5-6.3.1 libshibsp6-debuginfo-2.5.5-6.3.1 shibboleth-sp-2.5.5-6.3.1 shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): libshibsp-lite6-2.5.5-6.3.1 libshibsp-lite6-debuginfo-2.5.5-6.3.1 libshibsp6-2.5.5-6.3.1 libshibsp6-debuginfo-2.5.5-6.3.1 shibboleth-sp-2.5.5-6.3.1 shibboleth-sp-debuginfo-2.5.5-6.3.1 shibboleth-sp-debugsource-2.5.5-6.3.1 References: https://www.suse.com/security/cve/CVE-2017-16852.html https://bugzilla.suse.com/1068689 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3213-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 05 Dec '17

05 Dec '17

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3213-1 Rating: important References: #1068101 Cross-References: CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Software Development Kit 12-SP3 SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Desktop 12-SP3 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for MozillaFirefox ESR 52.5 fixes the following issues: Security issues fixed: - CVE-2017-7826: Memory safety bugs fixed (bsc#1068101). - CVE-2017-7828: Use-after-free of PressShell while restyling layout (bsc#1068101). - CVE-2017-7830: Cross-origin URL information leak through Resource Timing API (bsc#1068101). Mozilla Foundation Security Advisory (MFSA 2017-25): - https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/ Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1998=1 - SUSE Linux Enterprise Software Development Kit 12-SP3: zypper in -t patch SUSE-SLE-SDK-12-SP3-2017-1998=1 - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1998=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1998=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-1998=1 - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1998=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1998=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1998=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-1998=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1998=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1998=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-devel-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): MozillaFirefox-52.5.0esr-109.9.1 MozillaFirefox-debuginfo-52.5.0esr-109.9.1 MozillaFirefox-debugsource-52.5.0esr-109.9.1 MozillaFirefox-translations-52.5.0esr-109.9.1 References: https://www.suse.com/security/cve/CVE-2017-7826.html https://www.suse.com/security/cve/CVE-2017-7828.html https://www.suse.com/security/cve/CVE-2017-7830.html https://bugzilla.suse.com/1068101 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3212-1: important: Security update for xen
by opensuse-security＠opensuse.org 05 Dec '17

05 Dec '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3212-1 Rating: important References: #1061075 #1061081 #1061086 #1063123 #1068187 #1068191 Cross-References: CVE-2017-15289 CVE-2017-15592 CVE-2017-15595 CVE-2017-15597 Affected Products: SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This update for xen fixes several issues. These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). - CVE-2017-15595: x86 PV guest OS users were able to cause a DoS (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking (bsc#1061081). - CVE-2017-15592: x86 HVM guest OS users were able to cause a DoS (hypervisor crash) or possibly gain privileges because self-linear shadow mappings were mishandled for translated guests (bsc#1061086). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-xen-13366=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-xen-13366=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-xen-13366=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 x86_64): xen-kmp-default-4.2.5_21_3.0.101_0.47.106.8-45.16.1 xen-libs-4.2.5_21-45.16.1 xen-tools-domU-4.2.5_21-45.16.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (x86_64): xen-4.2.5_21-45.16.1 xen-doc-html-4.2.5_21-45.16.1 xen-doc-pdf-4.2.5_21-45.16.1 xen-libs-32bit-4.2.5_21-45.16.1 xen-tools-4.2.5_21-45.16.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586): xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.8-45.16.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): xen-kmp-default-4.2.5_21_3.0.101_0.47.106.8-45.16.1 xen-kmp-pae-4.2.5_21_3.0.101_0.47.106.8-45.16.1 xen-libs-4.2.5_21-45.16.1 xen-tools-domU-4.2.5_21-45.16.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 x86_64): xen-debuginfo-4.2.5_21-45.16.1 xen-debugsource-4.2.5_21-45.16.1 References: https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15592.html https://www.suse.com/security/cve/CVE-2017-15595.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1061081 https://bugzilla.suse.com/1061086 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3210-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 04 Dec '17

04 Dec '17

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3210-1 Rating: important References: #1047626 #1059465 #1066471 #1066472 #1069496 #860993 #975788 Cross-References: CVE-2014-0038 CVE-2017-1000405 CVE-2017-12193 CVE-2017-15102 CVE-2017-16525 CVE-2017-16527 CVE-2017-16529 CVE-2017-16531 CVE-2017-16535 CVE-2017-16536 CVE-2017-16537 CVE-2017-16649 CVE-2017-16650 CVE-2017-16939 Affected Products: SUSE OpenStack Cloud 6 SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages. (bnc#1069702) - CVE-2017-1000405: mm, thp: do not dirty huge pages on read fault (bnc#1069496). - CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1067085) - CVE-2014-0038: The compat_sys_recvmmsg function in net/compat.c, when CONFIG_X86_X32 is enabled, allowed local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter (bnc#860993). - CVE-2017-16650: The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1067086) - CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066700) - CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference. (bnc#1066705) - CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (bnc#1066671) - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations. (bnc#1066192) - CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066650) - CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup. (bnc#1066618) - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066573) - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066606) - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066625) The following non-security bugs were fixed: - NVMe: No lock while DMA mapping data (bsc#975788). - bcache: Add bch_keylist_init_single() (bsc#1047626). - bcache: Add btree_map() functions (bsc#1047626). - bcache: Add on error panic/unregister setting (bsc#1047626). - bcache: Convert gc to a kthread (bsc#1047626). - bcache: Delete some slower inline asm (bsc#1047626). - bcache: Drop unneeded blk_sync_queue() calls (bsc#1047626). - bcache: Fix a bug recovering from unclean shutdown (bsc#1047626). - bcache: Fix a journalling reclaim after recovery bug (bsc#1047626). - bcache: Fix a null ptr deref in journal replay (bsc#1047626). - bcache: Fix an infinite loop in journal replay (bsc#1047626). - bcache: Fix bch_ptr_bad() (bsc#1047626). - bcache: Fix discard granularity (bsc#1047626). - bcache: Fix for can_attach_cache() (bsc#1047626). - bcache: Fix heap_peek() macro (bsc#1047626). - bcache: Fix moving_pred() (bsc#1047626). - bcache: Fix to remove the rcu_sched stalls (bsc#1047626). - bcache: Improve bucket_prio() calculation (bsc#1047626). - bcache: Improve priority_stats (bsc#1047626). - bcache: Minor btree cache fix (bsc#1047626). - bcache: Move keylist out of btree_op (bsc#1047626). - bcache: New writeback PD controller (bsc#1047626). - bcache: PRECEDING_KEY() (bsc#1047626). - bcache: Performance fix for when journal entry is full (bsc#1047626). - bcache: Remove redundant block_size assignment (bsc#1047626). - bcache: Remove redundant parameter for cache_alloc() (bsc#1047626). - bcache: Remove/fix some header dependencies (bsc#1047626). - bcache: Trivial error handling fix (bsc#1047626). - bcache: Use ida for bcache block dev minor (bsc#1047626). - bcache: allows use of register in udev to avoid "device_busy" error (bsc#1047626). - bcache: bch_allocator_thread() is not freezable (bsc#1047626). - bcache: bch_gc_thread() is not freezable (bsc#1047626). - bcache: bugfix - gc thread now gets woken when cache is full (bsc#1047626). - bcache: bugfix - moving_gc now moves only correct buckets (bsc#1047626). - bcache: cleaned up error handling around register_cache() (bsc#1047626). - bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device (bsc#1047626). - bcache: defensively handle format strings (bsc#1047626). - bcache: fix BUG_ON due to integer overflow with GC_SECTORS_USED (bsc#1047626). - bcache: fix a livelock when we cause a huge number of cache misses (bsc#1047626). - bcache: fix crash in bcache_btree_node_alloc_fail tracepoint (bsc#1047626). - bcache: fix for gc and writeback race (bsc#1047626). - bcache: fix for gc crashing when no sectors are used (bsc#1047626). - bcache: kill index() (bsc#1047626). - bcache: register_bcache(): call blkdev_put() when cache_alloc() fails (bsc#1047626). - bcache: stop moving_gc marking buckets that can't be moved (bsc#1047626). - mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472). - mac80211: use constant time comparison with keys (bsc#1066471). - packet: fix use-after-free in fanout_add() - scsi: ILLEGAL REQUEST + ASC==27 produces target failure (bsc#1059465). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 6: zypper in -t patch SUSE-OpenStack-Cloud-6-2017-1995=1 - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2017-1995=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-1995=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2017-1995=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 6 (noarch): kernel-devel-3.12.74-60.64.66.1 kernel-macros-3.12.74-60.64.66.1 kernel-source-3.12.74-60.64.66.1 - SUSE OpenStack Cloud 6 (x86_64): kernel-default-3.12.74-60.64.66.1 kernel-default-base-3.12.74-60.64.66.1 kernel-default-base-debuginfo-3.12.74-60.64.66.1 kernel-default-debuginfo-3.12.74-60.64.66.1 kernel-default-debugsource-3.12.74-60.64.66.1 kernel-default-devel-3.12.74-60.64.66.1 kernel-syms-3.12.74-60.64.66.1 kernel-xen-3.12.74-60.64.66.1 kernel-xen-base-3.12.74-60.64.66.1 kernel-xen-base-debuginfo-3.12.74-60.64.66.1 kernel-xen-debuginfo-3.12.74-60.64.66.1 kernel-xen-debugsource-3.12.74-60.64.66.1 kernel-xen-devel-3.12.74-60.64.66.1 kgraft-patch-3_12_74-60_64_66-default-1-2.1 kgraft-patch-3_12_74-60_64_66-xen-1-2.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (ppc64le x86_64): kernel-default-3.12.74-60.64.66.1 kernel-default-base-3.12.74-60.64.66.1 kernel-default-base-debuginfo-3.12.74-60.64.66.1 kernel-default-debuginfo-3.12.74-60.64.66.1 kernel-default-debugsource-3.12.74-60.64.66.1 kernel-default-devel-3.12.74-60.64.66.1 kernel-syms-3.12.74-60.64.66.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (noarch): kernel-devel-3.12.74-60.64.66.1 kernel-macros-3.12.74-60.64.66.1 kernel-source-3.12.74-60.64.66.1 - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): kernel-xen-3.12.74-60.64.66.1 kernel-xen-base-3.12.74-60.64.66.1 kernel-xen-base-debuginfo-3.12.74-60.64.66.1 kernel-xen-debuginfo-3.12.74-60.64.66.1 kernel-xen-debugsource-3.12.74-60.64.66.1 kernel-xen-devel-3.12.74-60.64.66.1 kgraft-patch-3_12_74-60_64_66-default-1-2.1 kgraft-patch-3_12_74-60_64_66-xen-1-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): kernel-default-3.12.74-60.64.66.1 kernel-default-base-3.12.74-60.64.66.1 kernel-default-base-debuginfo-3.12.74-60.64.66.1 kernel-default-debuginfo-3.12.74-60.64.66.1 kernel-default-debugsource-3.12.74-60.64.66.1 kernel-default-devel-3.12.74-60.64.66.1 kernel-syms-3.12.74-60.64.66.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): kernel-devel-3.12.74-60.64.66.1 kernel-macros-3.12.74-60.64.66.1 kernel-source-3.12.74-60.64.66.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (x86_64): kernel-xen-3.12.74-60.64.66.1 kernel-xen-base-3.12.74-60.64.66.1 kernel-xen-base-debuginfo-3.12.74-60.64.66.1 kernel-xen-debuginfo-3.12.74-60.64.66.1 kernel-xen-debugsource-3.12.74-60.64.66.1 kernel-xen-devel-3.12.74-60.64.66.1 kgraft-patch-3_12_74-60_64_66-default-1-2.1 kgraft-patch-3_12_74-60_64_66-xen-1-2.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (s390x): kernel-default-man-3.12.74-60.64.66.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.74-60.64.66.1 kernel-ec2-debuginfo-3.12.74-60.64.66.1 kernel-ec2-debugsource-3.12.74-60.64.66.1 kernel-ec2-devel-3.12.74-60.64.66.1 kernel-ec2-extra-3.12.74-60.64.66.1 kernel-ec2-extra-debuginfo-3.12.74-60.64.66.1 References: https://www.suse.com/security/cve/CVE-2014-0038.html https://www.suse.com/security/cve/CVE-2017-1000405.html https://www.suse.com/security/cve/CVE-2017-12193.html https://www.suse.com/security/cve/CVE-2017-15102.html https://www.suse.com/security/cve/CVE-2017-16525.html https://www.suse.com/security/cve/CVE-2017-16527.html https://www.suse.com/security/cve/CVE-2017-16529.html https://www.suse.com/security/cve/CVE-2017-16531.html https://www.suse.com/security/cve/CVE-2017-16535.html https://www.suse.com/security/cve/CVE-2017-16536.html https://www.suse.com/security/cve/CVE-2017-16537.html https://www.suse.com/security/cve/CVE-2017-16649.html https://www.suse.com/security/cve/CVE-2017-16650.html https://www.suse.com/security/cve/CVE-2017-16939.html https://bugzilla.suse.com/1047626 https://bugzilla.suse.com/1059465 https://bugzilla.suse.com/1066471 https://bugzilla.suse.com/1066472 https://bugzilla.suse.com/1069496 https://bugzilla.suse.com/860993 https://bugzilla.suse.com/975788 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:3194-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Dec '17

02 Dec '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3194-1 Rating: important References: #1027519 #1055047 #1061075 #1063123 #1068187 #1068191 Cross-References: CVE-2017-15289 CVE-2017-15597 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: This update for xen to version 4.7.4 (bsc#1027519) fixes several issues. This new feature was added: - Support migration of HVM domains larger than 1 TB These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1322=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xen-debugsource-4.7.4_02-11.21.1 xen-devel-4.7.4_02-11.21.1 xen-libs-4.7.4_02-11.21.1 xen-libs-debuginfo-4.7.4_02-11.21.1 xen-tools-domU-4.7.4_02-11.21.1 xen-tools-domU-debuginfo-4.7.4_02-11.21.1 - openSUSE Leap 42.2 (x86_64): xen-4.7.4_02-11.21.1 xen-doc-html-4.7.4_02-11.21.1 xen-libs-32bit-4.7.4_02-11.21.1 xen-libs-debuginfo-32bit-4.7.4_02-11.21.1 xen-tools-4.7.4_02-11.21.1 xen-tools-debuginfo-4.7.4_02-11.21.1 References: https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:3193-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Dec '17

02 Dec '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3193-1 Rating: important References: #1027519 #1055047 #1061075 #1063123 #1068187 #1068191 Cross-References: CVE-2017-15289 CVE-2017-15597 Affected Products: openSUSE Leap 42.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: This update for xen to version 4.9.1 (bsc#1027519) fixes several issues. This new feature was added: - Support migration of HVM domains larger than 1 TB These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install This update was imported from the SUSE:SLE-12-SP3:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1321=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (x86_64): xen-4.9.1_02-13.2 xen-debugsource-4.9.1_02-13.2 xen-devel-4.9.1_02-13.2 xen-doc-html-4.9.1_02-13.2 xen-libs-4.9.1_02-13.2 xen-libs-debuginfo-4.9.1_02-13.2 xen-tools-4.9.1_02-13.2 xen-tools-debuginfo-4.9.1_02-13.2 xen-tools-domU-4.9.1_02-13.2 xen-tools-domU-debuginfo-4.9.1_02-13.2 References: https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3183-1: important: Security update for ncurses
by opensuse-security＠opensuse.org 01 Dec '17

01 Dec '17

SUSE Security Update: Security update for ncurses ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3183-1 Rating: important References: #1056127 #1056128 #1056129 #1056131 #1056132 #1056136 #1069530 Cross-References: CVE-2017-13728 CVE-2017-13729 CVE-2017-13730 CVE-2017-13731 CVE-2017-13732 CVE-2017-13733 CVE-2017-16879 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for ncurses fixes the following issues: Security issues fixed: - CVE-2017-13728: Fix infinite loop in the next_char function in comp_scan.c (bsc#1056136). - CVE-2017-13729: Fix illegal address access in the _nc_save_str (bsc#1056132). - CVE-2017-13730: Fix illegal address access in the function _nc_read_entry_source() (bsc#1056131). - CVE-2017-13731: Fix illegal address access in the function postprocess_termcap() (bsc#1056129). - CVE-2017-13732: Fix illegal address access in the function dump_uses() (bsc#1056128). - CVE-2017-13733: Fix illegal address access in the fmt_entry function (bsc#1056127). - CVE-2017-16879: Fix stack-based buffer overflow in the _nc_write_entry() function (bsc#1069530). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-ncurses-13364=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-ncurses-13364=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-ncurses-13364=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): ncurses-devel-5.6-93.12.1 tack-5.6-93.12.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (x86_64): ncurses-devel-32bit-5.6-93.12.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): libncurses5-5.6-93.12.1 libncurses6-5.6-93.12.1 ncurses-devel-5.6-93.12.1 ncurses-utils-5.6-93.12.1 tack-5.6-93.12.1 terminfo-5.6-93.12.1 terminfo-base-5.6-93.12.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): libncurses5-32bit-5.6-93.12.1 libncurses6-32bit-5.6-93.12.1 ncurses-devel-32bit-5.6-93.12.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libncurses5-x86-5.6-93.12.1 libncurses6-x86-5.6-93.12.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): ncurses-debuginfo-5.6-93.12.1 ncurses-debugsource-5.6-93.12.1 References: https://www.suse.com/security/cve/CVE-2017-13728.html https://www.suse.com/security/cve/CVE-2017-13729.html https://www.suse.com/security/cve/CVE-2017-13730.html https://www.suse.com/security/cve/CVE-2017-13731.html https://www.suse.com/security/cve/CVE-2017-13732.html https://www.suse.com/security/cve/CVE-2017-13733.html https://www.suse.com/security/cve/CVE-2017-16879.html https://bugzilla.suse.com/1056127 https://bugzilla.suse.com/1056128 https://bugzilla.suse.com/1056129 https://bugzilla.suse.com/1056131 https://bugzilla.suse.com/1056132 https://bugzilla.suse.com/1056136 https://bugzilla.suse.com/1069530 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3178-1: important: Security update for xen
by opensuse-security＠opensuse.org 01 Dec '17

01 Dec '17

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3178-1 Rating: important References: #1027519 #1055047 #1061075 #1063123 #1068187 #1068191 Cross-References: CVE-2017-15289 CVE-2017-15597 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. Description: This update for xen to version 4.7.4 (bsc#1027519) fixes several issues. This new feature was added: - Support migration of HVM domains larger than 1 TB These security issues were fixed: - bsc#1068187: Failure to recognize errors in the Populate on Demand (PoD) code allowed for DoS (XSA-246) - bsc#1068191: Missing p2m error checking in PoD code allowed unprivileged guests to retain a writable mapping of freed memory leading to information leaks, privilege escalation or DoS (XSA-247). - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063123) - CVE-2017-15597: A grant copy operation being done on a grant of a dying domain allowed a malicious guest administrator to corrupt hypervisor memory, allowing for DoS or potentially privilege escalation and information leaks (bsc#1061075). This non-security issue was fixed: - bsc#1055047: Fixed --initrd-inject option in virt-install Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-1987=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-1987=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-1987=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 x86_64): xen-debugsource-4.7.4_02-43.21.1 xen-devel-4.7.4_02-43.21.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): xen-4.7.4_02-43.21.1 xen-debugsource-4.7.4_02-43.21.1 xen-doc-html-4.7.4_02-43.21.1 xen-libs-32bit-4.7.4_02-43.21.1 xen-libs-4.7.4_02-43.21.1 xen-libs-debuginfo-32bit-4.7.4_02-43.21.1 xen-libs-debuginfo-4.7.4_02-43.21.1 xen-tools-4.7.4_02-43.21.1 xen-tools-debuginfo-4.7.4_02-43.21.1 xen-tools-domU-4.7.4_02-43.21.1 xen-tools-domU-debuginfo-4.7.4_02-43.21.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): xen-4.7.4_02-43.21.1 xen-debugsource-4.7.4_02-43.21.1 xen-libs-32bit-4.7.4_02-43.21.1 xen-libs-4.7.4_02-43.21.1 xen-libs-debuginfo-32bit-4.7.4_02-43.21.1 xen-libs-debuginfo-4.7.4_02-43.21.1 References: https://www.suse.com/security/cve/CVE-2017-15289.html https://www.suse.com/security/cve/CVE-2017-15597.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1055047 https://bugzilla.suse.com/1061075 https://bugzilla.suse.com/1063123 https://bugzilla.suse.com/1068187 https://bugzilla.suse.com/1068191 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:3177-1: important: Security update for openvpn-openssl1
by opensuse-security＠opensuse.org 01 Dec '17

01 Dec '17

SUSE Security Update: Security update for openvpn-openssl1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:3177-1 Rating: important References: #1060877 Cross-References: CVE-2017-12166 Affected Products: SUSE Linux Enterprise Server 11-SECURITY ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openvpn-openssl1 fixes the following issues: Security issue fixed: - CVE-2017-12166: Fix remote buffer overflow (bsc#1060877). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-openvpn-openssl1-13362=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): openvpn-openssl1-2.3.2-0.10.3.1 openvpn-openssl1-down-root-plugin-2.3.2-0.10.3.1 References: https://www.suse.com/security/cve/CVE-2017-12166.html https://bugzilla.suse.com/1060877 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0